Executive Summary

CVE-2026-2642 is a null pointer dereference vulnerability in the_silver_searcher software up to version 2.2.0. It occurs in the function search_stream within the source file src/search.c. The vulnerability happens because the code attempts to use a file stream pointer without verifying if it was successfully opened, leading to a NULL pointer being passed to the getline function. This causes a segmentation fault or crash when the program tries to read from this invalid pointer.

The issue requires local access to the system to be exploited and has been publicly disclosed with proof-of-concept exploits available. The vulnerability results in a denial of service by crashing the application.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause the_silver_searcher application to crash due to a segmentation fault triggered by a null pointer dereference. This leads to a denial of service condition where the software becomes unavailable or stops functioning correctly.

Since local access is required to exploit this vulnerability, an attacker with such access can intentionally cause the application to terminate unexpectedly, potentially disrupting workflows or automated processes that rely on the tool.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by reproducing the segmentation fault caused by the NULL pointer dereference in the_silver_searcher. The detection involves running the vulnerable version of the_silver_searcher with a specially crafted input file to trigger the crash.'}, {'type': 'paragraph', 'content': 'A suggested command to detect the vulnerability is to build the_silver_searcher with Release optimization and AddressSanitizer (ASan) enabled, then execute the following command:'}, {'type': 'list_item', 'content': './ag --workers=1 -z -a "hello" repro'}, {'type': 'paragraph', 'content': 'This command runs the tool with specific flags and input that triggers the NULL pointer dereference, causing a segmentation fault if the vulnerability is present.'}] [2, 5]

Useful 0 Not Useful 0

Mitigation Strategies

Currently, there are no known mitigations or fixes provided by the project for this vulnerability.

Immediate steps include avoiding the use of the vulnerable versions of the_silver_searcher (up to 2.2.0) and considering alternative products to prevent exposure to this NULL pointer dereference vulnerability.

Since the attack requires local access, restricting local user permissions and monitoring for suspicious activity may help reduce risk.

Useful 0 Not Useful 0